CVE-2020-26168

Improper Authentication in maven/com.hazelcast/hazelcast

Identifier

CVE-2020-26168

Package Slug

maven/com.hazelcast/hazelcast

Vulnerability

Improper Authentication

Description

The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise, and Jet Enterprise, does not verify properly the password in some system-user-dn scenarios. As a result, users (clients/members) can be authenticated even if they provide invalid passwords.

Affected Versions

All versions starting from 4.0 before 4.0.3

Solution

Upgrade to version 4.0.3 or above.

Last Modified

2020-11-19

source